topic Re: IPS Signature updates in Network Security

IPS Signature updates

networker99 — Sun, 10 Mar 2019 11:33:57 GMT

Is there a Cisco best practice for downloading IPS signature updates?, any documentation on this?, also how often are updates released?

Re: IPS Signature updates

rjaaouan — Thu, 26 Mar 2009 09:17:30 GMT

Hi,

to know all new Signature update, you can subsribe a ips-news@cisco.com distr list. You will revieve an email with all new Signature...

they will send you an email as soon as an update is availble, lik ethis:

1. Announcing the S387 Signature Update for IPS

The S387 signature update contains the following new signatures:

PLATFORM SIGID SIGNAME ENGINE SEVERITY ENABLED

5.x,6.x 6147.0 RealPlayer RealMedia Security Bypass string-tcp high false

5.x,6.x 6733.0 CA BrightStor ARCServe Backup LGServer Arbitrary File Upload string-tcp high false

5.x,6.x 6297.0 RealPlayer ActiveX Import Method Buffer Overflow meta high true

till now you need to download the signature on your compter, the upload it, or use an Autoupdate feature with the IDM.

I think Signatures are released, when there is new attack or weakness..., but you can use Anomaly Detection to detect any suspected behavior: Zero-Day detection.

Cheers

Reda

Re: IPS Signature updates

rjaaouan — Thu, 26 Mar 2009 09:47:51 GMT

Take a look also to this discussion:

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&topicID=.ee6e1fc&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cd25dcc